What Is DNS, and How Does It Actually Work?
Web & Networking - 3 min read - Published 2026-08-27 - Updated 2026-10-19
The Domain Name System (DNS) is the internet's directory. Computers connect to each other using numeric IP addresses, such as 203.0.113.10 or 2001:db8::1 (addresses reserved for examples like this one), but people use names like example.com. Every time you open a website, send an email or use an app, DNS quietly translates names into addresses, usually in a few milliseconds.
A lookup, step by step
Your device first asks a recursive resolver, usually run by your internet provider, your company, or a public service such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8. If the resolver has the answer cached from a recent lookup, it replies immediately.
If not, it works through the hierarchy. It asks a root server where to find servers for the top-level domain, such as .com. There are 13 named root server identities (A to M), each run as many copies around the world. The root points to the .com servers, which in turn point to the authoritative name servers for example.com - the servers that hold the domain's actual records, usually run by the domain's DNS host. The authoritative server returns the address, and the resolver passes it to your device and caches it.
Common record types
A records map a name to an IPv4 address, and AAAA records to an IPv6 address. CNAME records make one name an alias of another, such as www.example.com pointing to example.com. MX records say which servers receive email for the domain, with a priority number. TXT records hold free text, widely used for verification and email security policies such as SPF and DMARC. NS records list the authoritative name servers.
A DNS lookup tool shows exactly which records a domain has, which is the first step in checking a website or email setup.
Caching and TTL
Every record has a TTL (time to live), in seconds, which tells resolvers how long they may reuse a cached answer. A TTL of 3600 means one hour. Caching is what makes DNS fast and keeps the authoritative servers from being overwhelmed.
It's also why changes don't appear everywhere at once. What's often called "DNS propagation" isn't the new record spreading; it's old cached copies expiring at different times in resolvers around the world. If you plan to move a site, lowering the TTL a day beforehand means caches expire quickly after the switch.
Privacy and security
Traditional DNS queries travel unencrypted, so anyone on the network path can see which domains you look up. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt the queries, and most modern browsers and operating systems support them.
DNS can also be attacked: a forged answer could send you to a fake site. DNSSEC lets domain owners sign their records so resolvers can check they're genuine, though it isn't enabled for every domain. HTTPS adds another layer: even if DNS were tricked, a fake site couldn't present a valid certificate for the real domain.
Troubleshooting basics
If a site won't load but works for others, your device or resolver may have a stale cache. Restarting the browser or device, or flushing the DNS cache, often fixes it. On Windows the command is ipconfig /flushdns.
To see what a domain's records actually are, use a lookup tool, or the command-line tools nslookup (Windows, macOS, Linux) or dig (macOS, Linux). Comparing the answer from your usual resolver with a public one such as 1.1.1.1 shows whether a problem is local caching or the domain's own configuration. For email problems, check the MX records first; for a site that moved hosts, check the A and AAAA records.